[go/release-branch.go1.26] [release-branch.go1.26] os: properly handle trailing slashes in paths in Root
0 views
Skip to first unread message
David Chase (Gerrit)
3:16 PM (5 hours ago) 3:16 PM
to Gopher Robot, Damien Neil, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Junyang Shao, golang-co...@googlegroups.com
David Chase submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.26] os: properly handle trailing slashes in paths in Root
This change fixes a significant mechanism by which
operations in a Root can escape the root.
The implementation of Root on platforms supporting the openat
family of functions assumed that openat(parent, "f/", O_NOFOLLOW)
would not resolve symlinks in "f". This is not correct; the
trailing slash causes f to be resolved.
This permits Root operations to escape when the target filename
ends in a slash and the target is a symlink to a directory outside the
root. This does not permit directly accessing non-directory files
outside a root, since the trailing slash adds a requirement that the
target be a directory. However, under some circumstances an attacker
might exploit this flaw to access non-directory files outside
a root, for example by first renaming a directory outside the root
to a location within it and then accessing files within that directory.
This change adjusts Root's handling of slash-terminated paths.
Trailing slashes are removed from the path at the start of an
operation, and the presence of slashes is tracked as a boolean.
Slashes are never reattached to a path component.
In addition, the doInRoot helper function now automatically
handles trailing slashes in a POSIX-compatible fashion.
When a path ends in one or more slashes:
- symlinks in the final component are resolved; and
- the final path component after symlink resolutions
must reference a directory.
This change also adds a new sets of tests to exercise Root's
behavior in a wider variety of circumstances. These tests
run through a matrix of file configurations, such as:
- path "target", a regular file
- path "dir/../target", a directory
- path "target/", a symlink to "dir/../target/", which does not exist
- etc.
These tests execute Root operations and the corresponding unrooted
operation, validate specific expected results for some configurations,
and verify that the rooted and unrooted versions of the operation
produce the same result.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
Fixes #79005
Fixes CVE-2026-39822
Change-Id: I34072ab63f2367baf236592f11143f4e6a6a6964
Reviewed-by: Neal Patel <neal...@google.com>
Reviewed-by: Roland Shoemaker <brac...@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/797661
Reviewed-by: Junyang Shao <shaoj...@google.com>
Auto-Submit: Gopher Robot <go...@golang.org>
TryBot-Bypass: Gopher Robot <go...@golang.org>
Reviewed-by: David Chase <drc...@google.com>
Files:
- M src/os/export_test.go
- M src/os/root.go
- M src/os/root_js.go
- M src/os/root_noopenat.go
- M src/os/root_openat.go
- M src/os/root_test.go
- M src/os/root_unix.go
- M src/os/root_unix_test.go
- M src/os/root_windows.go
Change size: XL
Delta: 9 files changed, 1627 insertions(+), 120 deletions(-)
Branch: refs/heads/release-branch.go1.26
Submit Requirements:
Code-Review: +2 by David Chase, +2 by Junyang Shao
TryBots-Pass: TryBot-Bypass+1 by Gopher Robot
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
David Chase (Gerrit)
3:17 PM (5 hours ago) 3:17 PM
to Gopher Robot, Damien Neil, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Junyang Shao, golang-co...@googlegroups.com
David Chase submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.25] os: properly handle trailing slashes in paths in Root
Commit-Queue: Damien Neil <dn...@google.com>
Reviewed-by: Damien Neil <dn...@google.com>
Reviewed-by: Junyang Shao <shaoj...@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/797660
Auto-Submit: Gopher Robot <go...@golang.org>
TryBot-Bypass: Gopher Robot <go...@golang.org>
Reviewed-by: David Chase <drc...@google.com>
Files:
- M src/os/export_test.go
- M src/os/root.go
- M src/os/root_js.go
- M src/os/root_noopenat.go
- M src/os/root_openat.go
- M src/os/root_test.go
- M src/os/root_unix.go
- M src/os/root_unix_test.go
- M src/os/root_windows.go
Change size: XL
Delta: 9 files changed, 1627 insertions(+), 120 deletions(-)
Branch: refs/heads/release-branch.go1.25
Submit Requirements:
Code-Review: +2 by David Chase, +2 by Junyang Shao
TryBots-Pass: TryBot-Bypass+1 by Gopher Robot
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
David Chase (Gerrit)
3:30 PM (4 hours ago) 3:30 PM
to Gopher Robot, Damien Neil, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Junyang Shao, golang-co...@googlegroups.com
David Chase submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[release-branch.go1.27] os: properly handle trailing slashes in paths in Root
Commit-Queue: Neal Patel <neal...@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/797780
Reviewed-by: Junyang Shao <shaoj...@google.com>
Reviewed-by: David Chase <drc...@google.com>
TryBot-Bypass: Gopher Robot <go...@golang.org>
Auto-Submit: Gopher Robot <go...@golang.org>
Files:
- M src/os/export_test.go
- M src/os/root.go
- M src/os/root_js.go
- M src/os/root_noopenat.go
- M src/os/root_openat.go
- M src/os/root_test.go
- M src/os/root_unix.go
- M src/os/root_unix_test.go
- M src/os/root_windows.go
Change size: XL
Delta: 9 files changed, 1627 insertions(+), 120 deletions(-)
Branch: refs/heads/release-branch.go1.27
Submit Requirements:
Code-Review: +2 by David Chase, +2 by Junyang Shao
TryBots-Pass: TryBot-Bypass+1 by Gopher Robot
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gopher Robot (Gerrit)
5:11 PM (3 hours ago) 5:11 PM
to David Chase, Damien Neil, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, golang...@luci-project-accounts.iam.gserviceaccount.com, Neal Patel, Dmitri Shuralyov, Dmitri Shuralyov, Junyang Shao, golang-co...@googlegroups.com
Gopher Robot submitted the change![]( "Open in Gerrit")
Change information
Commit message:
os: properly handle trailing slashes in paths in Root
Reviewed-on: https://go-review.googlesource.com/c/go/+/797880
Auto-Submit: David Chase <drc...@google.com>
Reviewed-by: Dmitri Shuralyov <dmit...@golang.org>
Reviewed-by: Dmitri Shuralyov <dmit...@google.com>
Files:
- M src/os/export_test.go
- M src/os/root.go
- M src/os/root_js.go
- M src/os/root_noopenat.go
- M src/os/root_openat.go
- M src/os/root_test.go
- M src/os/root_unix.go
- M src/os/root_unix_test.go
- M src/os/root_windows.go
Change size: XL
Delta: 9 files changed, 1627 insertions(+), 120 deletions(-)
Branch: refs/heads/master
Submit Requirements:
Code-Review: +1 by Dmitri Shuralyov, +1 by Neal Patel, +2 by Dmitri Shuralyov
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages